SBOM details: confusing naming

[ctron]

I still find the labels confusing:

1. That's the package, component. I also assume that the "maven" label/tag comes from the PURL as well.
2. That's the PURL (or PURLs) of the package/component
3. That's the "base PURL" of the package/component
4. Those qualifiers come from the PURL, not from the package/component. As packages/components don't have that information.

[carlosthe19916]

Not sure how to interpret this issue.

• Is this a suggestion for "after" the release of v2.0? .- If so, then I guess some evaluation will need to be done while preparing the next version. E.g. v2.1 || v2.2
• Is this a suggestion for the upcomming release v2.0? .- If so, the requirement was compatibility with v1 UI and the screenshot you shared is what we have in v1.

[ctron]

This is an observation. A thing that, from my point of view, should be fixed. I'll leave the details to you.

[i386x]

@ctron @carlosthe19916 So what should be proper naming?

• Packages => PURLs
• Base package => Base PURL
• Qualifiers => PURL qualifiers

Or other?

[ctron]

I think, if want to be closer with the structure of the data, we should have:

• A list of all packages (SPDX)/components (CDX): not sure which term we use, but I think that we should use the same for all SBOM types (so other package or component, I think internally we use package now).
• Each package has a name, optional version and group.
• Each package also has a list of "external identifiers" (e.g. PURL, CPE, and/or hashes)

I don't think for 2.1 we should stick to renaming, but to refactoring the screen.

[carlosthe19916]

Moving this to a discussion as UX input is needed